Our client is a major ASX-listed Australian organisation with a large national footprint. Their Cyber Defence function protects a complex, high-volume workplace across thousands of endpoints, servers and users.
About the role
This is a hands-on SOC Level 2 role for someone who gets into the weeds. You’ll own escalations, investigate what’s happening at the endpoint and OS level, and drive incidents through to resolution during Melbourne business hours.
You’ll work closely with Cyber Defence colleagues in the overseas team, coordinating escalations and handovers to keep coverage seamless across regions.
Your responsibilities
Triage, investigate and respond to alerts and incidents, owning escalations from Level 1
Lead hands-on incident response: endpoint investigation, containment, remediation and recovery
Analyse suspicious activity across endpoints, servers, identities and networks
Coordinate response and handovers with offshore Cyber Defence teams
Use EDR/XDR, SIEM and monitoring tools to detect and investigate threats
Contribute to threat hunting, detection tuning and SOC improvement
Experience required
Proven experience as a SOC L2 Analyst, Incident Responder or similar hands-on role
Robust endpoint security and EDR investigation skills
Solid Windows, Windows Server, Active Directory and Microsoft troubleshooting (Linux a plus)
Working knowledge of MITRE ATT&CK; and incident response processes
Nice to have
Palo Alto Cortex XSIAM / XDR (highly regarded), but Defender for Endpoint, Sentinel, CrowdStrike, Splunk or similar are equally relevant
Endpoint forensics, threat hunting, PowerShell or automation
Product experience matters less than solid systems knowledge and genuine incident response capability.
J-18808-Ljbffr